In this demonstration,
we're going to look at the ingredients that go into a site‑to‑site VPN in
Azure, and we'll also do a brief tour of Azure Virtual WAN.
So let me open up my browser here and get into the portal,
and let me jump directly to the end case.
If we go to Connections we can see,
I want you to look at this top entry here, cloud to local.
So this is a site‑to‑site VPN that's linking a VPN gateway in my Azure
environment with a local environment where I've terminated the IPsec‑like
connection on that side, all right? And remember what we're dealing with
here. I think if I go back to my dashboard,
I've got several network topology diagrams that we can look at here.
Yeah,
so if you take a look at the left part where my mouse is, the exam is not
going to have us mess with the local side of the equation, but of course,
you're going to need to set up your VPN endpoint with a pre‑shared key.
That's how the authentication works between your virtual network gateway in
Azure and your local device, just PSK, pretty low tech. And it's basic IKEv2,
IPsec, but I'll show you how to modify those properties if you need to. In
the Azure side,
we're going to need our virtual network gateway deployed into its own subnet,
and that subnet has to have the name label, GatewaySubnet. Hopefully, it makes
sense that the gateway will have a public IP on it, at least one. We'll do a
local gateway that's essentially the way to notify the VNet gateway of what
your on‑premises environment looks like, and then you tie it all together with
the connection.
So there's three main ingredients, the gateway,
the local gateway, and the connection.
So speaking of gateway,
let's look up gateway in the global search and go to Virtual network gateways.
All right, so when you're setting up one of these,
what are some things to consider?
Well, let's see. If we go down under Configuration,
we've got a number of stock keeping units.
Now unfortunately, you can't choose them all after you've already
deployed the gateway. There are some availability zone aware gateway
SKUs, and I chose one of the non‑availability zone gateway SKUs, and
it's not giving me a chance to upgrade, unfortunately. I've mentioned
active‑active mode.
If you're going to do active‑active mode,
you're going to need a second public IP address besides the initial one that
you start with. And then in your on‑premises environment,
you'll create two VPN tunnels, one to each public IP address. As
long as you're using Border Gateway Protocol,
you then can configure active‑active failover. Now in BGP,
you're going to need a separate and distinct autonomous system number for your
VNet gateway, as well as your on‑premises gateway. There's public and private
ASN numbers just like there are with IPv4 addresses. I'm using 65501 here, and
I believe I'm using 65502 on‑premises.
And then again, because I'm using BGP,
I have a private peer address on the gateway, and I've configured one
in the same subnet range on‑prem on my edge device.
So I think that's mainly what we're talking about.
Let me disable active‑active mode here.
If I go back to Overview,
we can see the placement of this virtual network gateway here. It's on my
virtual network called vnet1. And if I go to Subnets, we can see that I've
created the Gateway subnet, and it's sitting at 10.11.1/24.
If I go back to the gateway one more time, here is the public IP
address. So we're going to absolutely want that, and we're also
going to want to have a pre‑shared key that will be shared between
our connection and our local router.
Okay,
so speaking of local router, we also in Azure need to
create a local network gateway.
Now, what are these?
These are simply the metadata of your on‑premises environment, what's going on
on the other side of the tunnel. If we go to Configuration,
this is going to be the public IP address of the remote on‑premises VPN device.
If you want to propagate private network ranges
from your on‑premises environment, you can list them under Address space.
Hopefully, it makes sense that you'd want to do that. And you can automate
that in terms of routes changing and so on by using BGP.
And this is specifying the ASN and BGP peer address of the local router,
you see. And they have to be different ASNs, and the BGP
peer IP should be in the same subnet range.
So that's what's going on with the local network gateway.
And lastly, we create a connection, and what is a connection? Well,
as I mentioned, they can take different forms based on what you're doing.
There's VNet‑to‑VNet VPN.
There's site‑to‑site VPN. There's ExpressRoute. This is a
site‑to‑site VPN. And if we go to Shared key,
unfortunately it reveals the PSK in plain text. In the real world,
you're going to want to have a really long complicated one, and this allows
the mutual authentication between this machine or this side of the
connection and on‑prem. If we go to Configuration,
this is where, again, you can ensure that BGP is being used or not.
We can customize the security association between your Azure
virtual network gateway and your local VPN gateway. It's called
IPsec / IKE policy. And if we go to Custom,
it allows you to customize the specific settings here.
And then lastly, Connection Mode. This supports businesses
that may not want a bidirectional VPN, you see.
So we can set up our Azure gateway to be only a responder that
hosts incoming traffic over the tunnel, or by contrast, we can set
it up as an initiator where we send traffic to on‑prem, but we
don't accept traffic from on‑prem.
All that make sense? And then as far as troubleshooting, we
can see the connection status right here,
but you'll probably want to go over to Network Watcher.
They have a capability in there called VPN troubleshoot.
And what you do here is you set up a storage account to store the detailed logs,
and then you specify your Azure VPN gateway and connection.
And it just does some long‑running transactions to gather low‑level
data in terms of what's transpiring on the gateway.
So it's a good tool to have in your toolkit,
as far as troubleshooting stuff, to get that level of
familiarity. And you can go into the storage account and capture those log files to your heart's content.